Hi Steve, The translation is happening in the Web proxy service. You basically have two options; server publish the web sites or bounce the ISA WEB..logs against the IIS logs to get the real client-ip. Since ISA is actually proxying the request, it's ISA making the request to the IIS server. Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/authors/harrison http://jalojash.org/isatools Read the books! ----- Original Message ----- From: "Steve Goudreau" <sgoudreau@xxxxxxxxxxxx> To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx> Sent: Tuesday, August 06, 2002 6:57 AM Subject: [isalist] ISA and IIS http://www.ISAserver.org I have several websites published behind my ISA server using host headers. When I check my IIS logs or run a report through WebTrends It only shows one unique IP that ever visits the site, that being the IP of the Internal Interface on the ISA Server. In the Reports Generated through ISA server it shows hundreds of Different IP's of users that have visited these sites but somewhere between ISA and IIS that translation is getting lost. Is this due to SNAT? Any help anyone could provide on this would be greatly appreciated. Thanks Steve Goudreau Systems Engineer Internet Operations Center Inc. www.iocenter.net ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')